Terms Unconditional

Companies

Company records matching your filters, worst first. Rows marked unverified have not been checked against a primary source.

Results

TJX (TJ Maxx/Marshalls/HomeGoods)

Retail & Fintech

Attackers broke into TJX in July 2005 by cracking the WEP encryption on the Wi-Fi at a Miami-area Marshalls, then moved to the central payment servers and sat…

Severity 5 of 5.
Last verified 96 days ago
Unassigned

Dave

Retail & Fintech · unverified

The July 2020 Dave breach came through Waydev, a third-party analytics vendor - the same vendor-chain structure documented in the AMCA, SITA and Salesloft…

Severity 4 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Kraken (Payward, Inc.)

Retail & Fintech · unverified

VERIFIED: the SEC's 2023 suit alleging Kraken ran an unregistered securities exchange was dismissed WITH PREJUDICE by joint stipulation in March 2025.

Severity 4 of 5, not independently verified.
Last verified 23 days ago
Unassigned

Cricket Wireless (AT&T)

Retail & Fintech · unverified

The 2024 Cricket exposure came through the same AT&T-related incidents documented in the Carriers tab, and the structural finding is the prepaid distinction…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Crypto.com

Retail & Fintech · unverified

In January 2022 attackers took about $34 million in crypto from 483 Crypto.com customer accounts.

Severity 3 of 5, not independently verified.
Last verified 23 days ago
Unassigned

Dick's Sporting Goods

Retail & Fintech · unverified

The 2024 incident was disclosed to the SEC (an Aug 2024 Form 8-K under Item 8.01, in which Dick's said it believed the incident was not material), which is…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Earnin (Activehours, Inc.)

Retail & Fintech · unverified

Earnin disclosed a breach to the Texas Attorney General (with consumer notices going out around November 12, 2025) - and the disclosure route is the practical…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Sephora (LVMH)

Retail & Fintech · unverified

Sephora's Virtual Artist try-on drew a BIPA suit on the same theory as Ulta's GLAM Lab - facial geometry captured to render a cosmetic preview.

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Ulta Beauty

Retail & Fintech · unverified

The BIPA class actions concern Ulta's GLAM Lab virtual try-on, and the mechanism is the point: a feature that lets you see how lipstick would look requires…

Severity 3 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Audible (Amazon)

Retail & Fintech · unverified

Nothing confirmed

Severity 2 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Google Fi

Retail & Fintech · unverified

The January 2023 Google Fi disclosure is notable for what it reveals about mobile virtual network operators…

Severity 2 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Grubhub

Retail & Fintech · unverified

Grubhub confirmed in January 2026 that unauthorized parties had downloaded data from certain of its systems…

Severity 2 of 5, not independently verified.
Last verified 96 days ago
Unassigned

Ross Dress for Less

Retail & Fintech · unverified

Nothing confirmed

Severity 2 of 5, not independently verified.
Last verified 96 days ago
Unassigned